Optical fiber link control safety system

Abstract

A fully redundant safety interlock system is provided comprising, means for detecting the loss of light on a fiber optic link; controller means, coupled to said means for detecting, for determining the safety condition of the link based on the output of said means for detecting, and for controlling the radiant energy output of an optical transmitter, based on the determined safety condition, via redundant output control signals; and means, coupled to said controller means, responsive to said redundant control signals, for interconnecting the output of said controller means to transmitter drive circuitry to thereby adjust the radiant energy output by the transmitter. According to a preferred embodiment of the invention, the controller means includes an electronic implementation of two independent state machines, each of which redundantly determines the connection state of the optical link between two optical link cards. The output from the state machines is used to adjust (for example, turn on and turn off) the drive circuitry for the transmitter via fully redundant paths which carry the redundant control signals.

What is claimed is: 
     
       1. A fully redundant safety interlock for a fiber optic link, comprising: (a) means for detecting loss of light on said link, including means for separately outputting at least two independent loss of light signals; and   (b) controller means, coupled to said means for separately outputting, for controlling the radiant energy output by an optical transmitter, based at least in part on the values of said independent loss of light signals as separately outputted by said means for detecting.   
     
     
       2. Apparatus as set forth in claim 1 wherein said controller means is operative to cause the radiant energy output by said optical transmitter to be limited or shut off whenever said transmitter is continuously outputting radiant energy and nay of said loss of light signals indicate loss of light on the link. 
     
     
       3. Apparatus as set forth in claim 1 wherein said controller means further comprises: (a) means for determining the safety condition of said link, in terms of whether or not the link is closed and contains functioning safety apparatus at the opposite end of the link, including means for outputting at least two separate signals indicative of said safety condition; and   (b) output means, coupled to said means for determining, for outputting redundant signals in response to said separate signals, wherein said redundant signals are be used to control the radiant energy output by said transmitter.   
     
     
       4. Apparatus as set forth in claim 3 wherein said means for determining further comprises a plurality of state machines, the states of which are used, together with said independent loss of light signals, to determine the safety condition of said link. 
     
     
       5. Apparatus as set forth in claim 4 wherein said means for detecting further comprises a plurality of timers, each associated with one of said plurality of state machines. 
     
     
       6. Apparatus as set forth in claim 4 wherein said state machines each include at least a check state, corresponding to an inactive mode of said transmitter; an active state, corresponding to an active mode of said transmitter; and both a stop state and a connect state, which exist when said transmitter is in a connect mode. 
     
     
       7. Apparatus as set forth in claim 6 wherein the redundant signals outputted by said controller means are operative to cause said transmitter to be pulsed at a predetermined frequency during said inactive mode. 
     
     
       8. Apparatus as set forth in claim 6 wherein the redundant signals outputted by said controller means are operative to cause reconnection handshake signals to be outputted by said transmitter during said connect mode, to enable said controller means to determine if said link is closed and that functioning safety apparatus exists at the opposite end of the link. 
     
     
       9. Apparatus as set forth in claim 8 wherein said redundant signals outputted by said controller means are operative to inhibit continuous power from being provided to said transmitter unless said controller means determines during said connect mode that said link is closed and contains functioning safety apparatus at the opposite end of the link. 
     
     
       10. Apparatus as set forth in claim 6 wherein the redundant signals outputted by said controller means are operative to provide continuous power to said transmitter during said active mode. 
     
     
       11. Apparatus as set forth in claim 3 further comprising interconnect means, coupled to said output means, for interconnecting said redundant signals to transmitter drive circuitry. 
     
     
       12. Apparatus as set forth in claim 11 wherein said interconnect means comprises a redundant laser switch that requires redundant signal inputs of opposite polarity to continuously activate said transmitter. 
     
     
       13. Apparatus as set forth in claim 3 wherein said controller means is responsive to user generated power on reset signals and, in response thereto, first determines the safety condition of said link before permitting the transmitter to be continuously activated. 
     
     
       14. Apparatus as set forth in claim 1 wherien said means for detecting further comprises at least two independent light sensors. 
     
     
       15. Apparatus as set forth in claim 14 wherein at least one of said light sensors is an envelope detector requiring a threshold peak to peak AC voltage frequency to be activated. 
     
     
       16. Apparatus as set forth in claim 14 wherein at least one of said light sensors is utilized to sense the average DC current resulting from detected light. 
     
     
       17. Apparatus as set forth in claim 1 wherein said controller means further comprises means for powering down said transmitter in response to user input control signals. 
     
     
       18. Apparatus as set forth in claim 1 wherein said controller means further comprises means for signalling inactive link status to a user. 
     
     
       19. A fully redundant safety interlock for a fiber optic link, comprising: (a) means for sensing a fiber disconnect as a function of at least two independent signals which separately indicate the presence or absence of light on said link, wherein each of said signals is developed utilizing differing sensing criteria and further wherein each of said signals is separately outputted from said means for sensing; and   (b) controller means, coupled to the output of said means for sensing, operative to cause the radiant energy outputted by an optical transmitter to be limited or shut off whenever a fiber disconnect is sensed.   
     
     
       20. Apparatus as set forth in claim 19 wherein said controller means further comprises means for periodically causing said transmitter to emit pulses used to determine if said fiber has been reconnected. 
     
     
       21. Apparatus as set forth in claim 20 wherein said controller means further comprises means for causing reconnect handshake signals to be outputted by said transmitter, to enable said controller means to determine if said link is closed and that functioning safety apparatus exists at the opposite end of the link. 
     
     
       22. Apparatus as set forth in claim 21 wherein said controller means further comprises means for causing the restoration of continuous radiant energy outputted by said transmitter whenever said fiber has been reconnected, so long as said reconnect handshake signals indicate that functioning safety apparatus exists at the opposite end of the link. 
     
     
       23. An open fiber link safety system for providing a fully redundant safety interlock for a fiber optic link wherein said link includes first and second optical link cards, each of which is capable of transmitting and receiving data over said link, and further wherein said first card includes a first optical transmitter, drive means for said first transmitter, and first receiver/amplifier means; and further wherein said second card includes a second optical transmitter, driver means for said second transmitter, and second receiver/amplifier means, comprising: (a) first safety means, coupled between said driver means for said first optical transmitter and said first receiver/amplifier means; and   (b) second safety means, coupled between said driver means for said second optical transmitter and said second receiver/amplifier means, wherein said first and second safety means each comprise means for detecting loss f light on said link, including means for separately outputting at least two independent loss of light signals wherein each of said signals is developed utilizing differing criteria for detecting loss of light, and further wherein said first and second safety means are each operative to power down the respective transmitters to which they are coupled upon detecting a break in said link.   
     
     
       24. Apparatus as set forth in claim 23 wherein each of said safety means further comprises controller means, coupled to said means for detecting, for controlling the radiant energy outputted by an optical transmitter, based at least in part on the values of said independent loss of light signals.   
     
     
       25. Apparatus as set forth in claim 24 wherein each of said safety means is further operative to cause continuous radiant energy to be generated by said first and second optical transmitters, when a link is being initialized or reconnected, only if each safety means is able to verify the existence of the other safety means as part of the link. 
     
     
       26. Apparatus as set forth in claim 24 wherein each of said controller means further comprises: (a) means for determining the safety condition of said link, in terms of whether or not the link is closed and contains functioning safety apparatus at the opposite end of the link, including means for outputting at least two separate signals indicative of said safety condition; and   (b) output means, coupled to said means for determining, for outputting redundant signals in response to said separate signals, wherein said redundant signals may be used to control the radiant energy output by said transmitter.   
     
     
       27. Apparatus as set forth in claim 26 wherein said means for determining further comprises a plurality of state machines, the states of which are used, together with said independent loss of light signals, to determine the safety condition of said link. 
     
     
       28. Apparatus as set forth in claim 27 wherein said means for detecting further comprises a plurality of timers, each associated with one of said plurality of state machines. 
     
     
       29. A method for providing a fully redundant safety interlock for a fiber optic link, wherein said link includes a first optical fiber, a second optical fiber, first and second optical link cards, each of which is capable of transmitting and receiving data over said link, and further wherein said first card includes a first optical transmitter for transmitting optical signals between said first card and said second card via said first fiber, first receiver/amplifier means, first safety control means and first timer means; and further wherein said second card includes a second optical transmitter for transmitting optical signals between said second card and said first card via said second fiber, second receiver/amplifier means, second safety control means and second timer means, comprising the steps of: (a) disabling said first and second optical transmitters whenever said first optical fiber is disconnected by: (a1) generating a first loss of light signal via said second receiver/amplifier means, for use by said second safety control means whenever said first fiber is disconnected from the link;   (a2) powering down said second optical transmitter, via said second safety control means, in response to said first loss of light signal;   (a3) generating a second loss of light signal, via said first receiver/amplifier means, as a result of said second optical transmitter being powered down; and   (a4) powering down said first optical transmitter, via said first safety control means, in response to said second loss of light signal, to thereby create a safe condition with respect to the open link created by the disconnection of said first optical fiber;     (b) starting a timer maintained by said second timer means when said second optical transmitter is powered down according to step (a2);   (c) starting a timer maintained by said first timer means, wherein the timers maintained by said first and second timer means are distinct, when said first optical transmitter is powered down according to step (a4); and   (d) powering up each of said first and second optical transmitters after a time period T, for a smaller time period t, in a synchronous fashion, in order to check link status.   
     
     
       30. A method as set forth in claim 29 further comprising the step of generating reconnect handshake signals via said first and second safety control means to verify closed link status and verify that a functioning safety device exists at both ends of the link. 
     
     
       31. A method as set forth in claim 30 further comprising the step of permitting continuous radiant energy to be outputted by both said first and second optical transmitters in the event both closed link status and the existence of a functioning safety device at both ends of the link are verified via said handshake signals. 
     
     
       32. A method as set forth in claim 31 further comprising the step of powering down said first and second optical transmitters for time period T and repeating step (d) if said handshake signal fails to verify both closed link status and the existence of a functioning safety device at both ends of the link. 
     
     
       33. A method for providing a fully redundant safety interlock for a fiber optic link, wherein said link includes a first optical fiber, a second optical fiber, first and second optical link cards, each of which is capable of transmitting and receiving data over said link and further wherein said first card includes a first optical transmitter for transmitting optical signals between said first card and said second card via said first fiber, first receiver/amplifier means, first safety control means and first timer means; and further wherein said second card includes a second optical transmitter for transmitting optical signals between said second card and said first card via said second fiber, second receiver/amplifier means, second safety control means and second timer means, comprising the steps of: (a) disabling said first and second optical transmitters whenever said second optical fiber si disconnected by: (a1) generating a first loss of light signal via said first receiver/amplifier means, for use by said first safety control means whenever said second fiber is disconnected from the link;   (a2) powering down said first optical transmitter, via said first safety control means, in response to said first loss of light signal;   (a3) generating a second loss of light signal, via said second receiver/amplifier means, as a result of said first optical transmitter being powered down; and     (a4) powering down said second optical transmitter, via said second safety control means, in response to said second loss of light signal, to thereby create a safe condition with respect to the open link created by the disconnection of said second optical fiber;   (b) starting a timer maintained by said fist timer means when said first optical transmitter is powered down according to step (a2);   (c) starting a timer maintained by said second timer means, wherein the timers maintained by said first and second timer means are distinct, when said second timer means are distinct, when said second optical transmitter is powered down according to step (a4); and   (d) powering up each of said first and second optical transmitters after a time period T, for a smaller time period t, in a synchronous fashion, in order to check link status.   
     
     
       34. A safety interlock for a fiber optic link, comprising: (a) means for sensing a fiber disconnect as a function of a signal which indicates the presence or absence of light on said link;   (b) controller means, coupled to said means for sensing, operative to cause the radiant energy output by an optical transmitter to be limited or shut of whenever a fiber disconnect is sensed, wherein said controller means further comprises: (b1) means for periodically causing said transmitter to emit pulses used to determine if said fiber has been reconnected;   (b2) means for causing reconnect handshake signals to be output by said transmitter, to enable said controller means to determine if said link is closed; and   (b3) means for causing the restoration of continuous radiant energy to be output by said transmitter whenever said fiber has been reconnected.     
     
     
       35. A safety interlock for a fiber optical link having an optical transmitter and detector of radiant energy for communicating data to and from a remote unit as radiant energy over optical fibers, comprising: (a) a receiver coupled to said detector means for sensing loss of said radiant energy from one of said fibers carrying said data;   (b) a driver coupled to said transmitter for limiting the optical output of said transmitter;   (c) a controller coupled to said receiver and driver, and including first means for limiting said optical output in response to said loss of radiant energy, second means responsive to said first means to pulse said driver in a predetermined handshake sequence, and third means responsive to said second means and to a predetermined handshake response from said remote unit on one of said optical fibers to inhibit said driver from limiting said output.   
     
     
       36. A method for providing safety in a link having a plurality of optical fibers for transmitting data as a first level of radiant energy over a first of said optical fibers from a local data system to a remote data system and for receiving data from a remote system over a second of said optical fibers, said method comprising; (a) detecting a loss of radiant energy in said first optical fiber;   (b) after step (a), limiting the radiant energy transmitted on said first optical fiber to a second level which is lower than said first level;   (c) after step (b), receiving at said local data system a predetermined handshake response in said first optical fiber indicating that said one optical fiber has been reconnected; and   (d) after step (c), resuming said first level of radiant energy in said first optical fiber.   
     
     
       37. A method as set forth in claim 36 wherein said step of limiting radiant energy transmitted on said first optical fiber further comprises the step of transmitting a sequence of pulses in a predetermined handshake sequence on said first optical fiber.